🐀🐀🐀🐀
🧩 LDAP Lab · 1 Machine
A two-machine Active Directory lab focused on pivoting. Only the domain controller (CORP-DC01) is internet-facing — the workstation lives deeper on the internal network. Enumerate the DC’s SMB shares, harvest credentials, then pivot inward to the domain-joined workstation (reachable at corp-ws.default.svc.cluster.local on standard ports 22/80/445, or straight from the in-browser Pwnbox) and chain the credential leaks to full domain compromise.
OSCP
Active Directory
🐀🐀🐀🐀🐀
🔒 Premium Only
🧩 LDAP Lab · 2 Machines
A two-machine Active Directory lab focused on MS14-025 (GPP credential harvest). Start with an exposed backup config on the workstation, then pivot to the domain controller via SYSVOL to decrypt the service account password and achieve root.
OSCP
Active Directory
🐀🐀🐀🐀🐀
🧩 LDAP Lab · 1 Machine
A three-machine Active Directory lab focused on network pivoting. Only the domain controller is exposed to the internet. Players must chain SMB credential harvesting on the DC, SSH tunnelling, unrestricted file-upload RCE on the internal web server, and MySQL credential extraction on the internal database to fully compromise all three machines.
OSCP
Active Directory
Pivoting
🐀
🔒 Premium Only
🧩 LDAP Lab · 1 Machine
Five connected hosts. A company got compromised. You are the incident responder. Start here and follow the trail.
--- Accessing the estate ---
You're issued an incident-responder account: analyst / analyst123 (it works on every host). Only the CIRT gateway (cirt-gateway) is internet-facing — read its mission brief first. The other four hosts (siem-lab-pt, soar-lab, code-review-lab, active-defense-lab) live on the internal network.
Reach them from your cirt-gateway shell, or from the in-browser Pwnbox, at <host>.default.svc.cluster.local (e.g. ssh analyst@siem-lab-pt.default.svc.cluster.local) on standard ports — or tunnel out (ssh -D / proxychains) and investigate from your own box. Work each host with your analyst account.
Web
Network
Enumeration
Purple Team
🐀
🔒 Premium Only
🧩 LDAP Lab · 1 Machine
A telecom startup exposed its internal protocol stack. Navigate legacy daemons, misconfigured services, and credential leaks through five interconnected hosts.
--- How to pivot ---
Only the FTP gateway (sw-ftp) faces the internet — the other four hosts are reachable ONLY from inside the network. The play: pop sw-ftp first, then tunnel through it to reach the rest.
1. Land on sw-ftp. From that shell, the internal hosts answer on the cluster network at their service hostnames: sw-smtp, sw-redis, sw-rsync, sw-snmp (FQDN: <host>.default.svc.cluster.local) on STANDARD ports (SSH 22, SMTP 25, HTTP 80, Redis 6379, rsync 873, SNMP 161/udp) — not the public 30xxx ports.
2. Tunnel to scan/exploit them from your own box: SSH dynamic forward (ssh -D 1080 user@sw-ftp...) + proxychains, or per-service local forwards (ssh -L 6379:sw-redis:6379 user@sw-ftp...). Or just launch the in-browser Pwnbox — it sits inside the network and can hit them directly.
3. Each host has its OWN credentials — loot from one box won't log you into the next. Exploit each service to recover that host's creds.
Reachability: sw-ftp -> sw-smtp / sw-redis / sw-rsync / sw-snmp. Work the chain.
Operation Switchboard
Network
File Shares
Enumeration
🐀
🧩 LDAP Lab · 1 Machine
Blacksite built five internal web tools in a hurry. Every tool has a classic OWASP Top 10 flaw. Move through the estate extracting credentials from each.
Blacksite Webapp
Web
Database
🐀
🔒 Premium Only
🧩 LDAP Lab · 1 Machine
A CI/CD pipeline exposed from dev to prod. Leaked commits, environment variables, registry credentials, and build server access form a chain from source to root.
Pipeline Breach
DevOps
Enumeration
🐀
🔒 Premium Only
🧩 LDAP Lab · 1 Machine
Five microservices shipped without a security review. BOLA, mass assignment, JWT forgery, broken function-level auth, and SSRF — the OWASP API Security Top 10 distilled into a single estate.
Exposed API
Web
Enumeration
🐀
🔒 Premium Only
🧩 LDAP Lab · 1 Machine
Cryptovault rolled its own crypto. Five services expose predictable tokens, crackable JWT secrets, hash length extension, padding oracles, and a factorizable RSA key.
Cryptovault
Web
🐀
🔒 Premium Only
🧩 LDAP Lab · 1 Machine
Five containers with dangerous misconfigurations — capability abuse, proc filesystem leaks, writable host mounts, Docker socket escapes, and the cgroups notify_on_release technique.
Containment Failure
DevOps
Privesc
🐀
🔒 Premium Only
🧩 LDAP Lab · 1 Machine
Five SUID binaries, five memory corruption vulnerabilities. ret2win, shellcode injection, ROP chains, format string exploitation, and heap corruption — built for binary exploitation beginners.
Memory Lane
Binary Exploit
Privesc
🐀
Relay is a beginner-friendly pivot box: ten user accounts, ten flags, one flag per user. You are handed the first account — SSH in directly as relay01 with password R3lay_St4rt_01 (no exploit needed to land the first user), grab the flag, and find the clue each user leaves behind for the next. Walk the chain relay01 → relay02 → … → relay10. NOTE: there is NO root on this machine and no privilege-escalation path. The whole challenge is lateral movement between users — do not waste time hunting for root.
Pivoting
Enumeration
🐀
Axferia's nameserver has been running in the corner of the datacenter since before anyone on the team can remember. Nobody touches it. Nobody audits it. The sysadmin who set it up left years ago — and took the hardening checklist with him.
OSCP
Network
Enumeration
🐀
Listeria started as a quick internal tool that was never meant to face the world. Then someone pointed a domain at it. A Friday afternoon deploy. No review. The developer responsible has since changed departments.
OSCP
CPTS
Web
🐀🐀
🔒 Premium Only
Every enterprise has a directory. Bindforge's directory holds the full map of who has access to what — accounts, groups, and a few fields that the original engineer populated a little too liberally. It was only ever meant to be accessed from inside the building.
OSCP
CPTS
Database
Active Directory
🐀🐀
🔒 Premium Only
The Rootbase server has been the backbone of three different applications over five years. Each team that inherited it assumed the previous one had secured it properly. None of them checked.
OSCP
Database
🐀🐀🐀🐀
🔒 Premium Only
Keyspace was provisioned as a temporary caching layer during a product launch. The launch went well. The cleanup never happened. The server is still running, still reachable, and nobody on the current team knows its password — or whether it has one.
OSCP
Database
🐀🐀
🔒 Premium Only
Driftsync runs nightly, faithfully mirroring data from one machine to the next. The engineer who wrote the job configured it to be 'easy to use'. He was proud of how accessible he'd made it. That was two years ago.
OSCP
Network
File Shares
🐀🐀🐀
🔒 Premium Only
Bifrost was set up to bridge two legacy teams who couldn't agree on a file-sharing standard. So they ran both. Twice the surface, half the oversight. Somewhere in the middle of all that data lives a path forward.
OSCP
CPTS
Network
File Shares
🐀🐀
🔒 Premium Only
Postmark handles internal mail for a small ops team. It was stood up fast, kept running through three infrastructure migrations, and never got the security hardening that was always on next quarter's roadmap.
OSCP
Network
Enumeration
🐀🐀
🔒 Premium Only
Walkabout is the network monitoring node that nobody monitors. It has a view of every device on the segment — interface stats, process lists, everything the ops team ever thought to wire up. It reports faithfully to whoever asks.
OSCP
Network
Enumeration
🐀
Retrogate is the last machine in the building still running the old remote access service from the early 2000s. It survived every migration plan because removing it was always someone else's problem. The sysadmin who set it up retired. His habits did not.
OSCP
Network
🐀
🔒 Premium Only
Bootleak's network boot server was set up to provision diskless clients in a lab that no longer exists. The server outlived the lab. It still serves. It still responds. It has no idea it shouldn't.
OSCP
Network
🐀🐀
Neuravex is CorpTech's shiny new internal AI assistant. The engineers shipped it fast, the executives loved it, and nobody asked too many questions about how it was built. It knows a lot. It's happy to talk. The question is how to make it tell you the right things.
Web
🐀🐀🐀
The employee portal was built by a contractor in 2019, accepted without a security review, and has been quietly running ever since. It handles timesheets, leave requests, and a few internal tools nobody fully remembers adding. The codebase has never been audited.
OSCP
CPTS
Web
🐀🐀🐀🐀🐀
🔒 Premium Only
The XSS Rat's personal research lab: a tangled mess of a PHP blog, an undocumented internal service, and the kind of server that accumulates features faster than it accumulates security reviews. Every quirk is deliberate. Every clue is earned.
Web
🐀🐀🐀
🔒 Premium Only
Deep beneath the city streets runs the RatHole — a forgotten server maintained by a rodent with more enthusiasm than operational discipline. The setup is scrappy, the maintenance is creative, and root has been running things down here for longer than anyone cares to admit.
Network
Pivoting
🐀🐀
The document viewer was built over a long weekend to replace a tool that no longer worked. It went live on Monday. It has never been reviewed. The developer who built it is very proud of how quickly it shipped.
CPTS
Web
🐀🐀
The NFS server was set up to make file access easy across the team. It succeeded. It made access very easy. The engineer who configured it trusted the network perimeter to do the hard work — a decision that made sense at the time.
Network
Privesc
File Shares
🐀
Porthaven was designed to be hard to find. The engineer who built it believed obscurity was a valid security layer and documented that belief in a config file he left on the server. The admin panel is hidden. The key to finding it is not.
Network
🐀🐀
🔒 Premium Only
Glasswork is the team's build server — the machine that turns code into deployments. Someone stood it up in an afternoon, got the pipelines working, and moved on. The pipelines still run. The hardening ticket never got prioritised.
Web
🐀🐀
🔒 Premium Only
Irongrep is the search backbone for a product that got acquired and then deprioritised. The engineering team moved on. The server did not. It still indexes, still serves queries, and still holds everything that was ever put into it.
Web
🐀
The sysadmin who ran Shellcast was meticulous about backups. Every week, a snapshot. Every directory, archived. He never thought carefully about what those backups contained — or where they were stored.
Network
🐀🐀🐀🐀🐀
🔒 Premium Only
Darkpulse is a full Active Directory environment built by an ops team that grew too fast to keep up with its own complexity. Every layer trusts the one beneath it. The monitoring system has a view of everything — and so will you, once you understand what it's reporting.
Web
🐀🐀
🔒 Premium Only
Foxhole's authentication system was written by a developer who read the documentation, just not all of it. The gate looks solid from the outside. The question is whether you understand how the lock actually works.
Network
🐀🐀🐀🐀
🔒 Premium Only
Tracewire's FTP server was used once, during a late-night maintenance window, by an engineer who was troubleshooting a network issue and capturing everything. The capture was archived. The archive was left on the server. The session contained more than just packet headers.
Network
🐀🐀🐀
Tempest is an internal reporting tool that the development team is quietly proud of. It renders fast, it looks clean, and it was built without once consulting the documentation on safe input handling.
CPTS
Web
🐀🐀
🔒 Premium Only
DocuParse processes invoices for an accounts team that needed automation fast. The developer who built it enabled every feature the XML library offered, valued flexibility, and shipped the Friday before a long weekend.
CPTS
Web
🐀🐀🐀
Jailkey is the authentication layer for a suite of internal tools. The team built it themselves rather than pulling in a dependency. They were thorough. They were careful. They just left one door open that they assumed nobody would find.
Web
🐀🐀🐀🐀🐀
🔒 Premium Only
HexVault is a classified document management system used by a fictional intelligence contractor. It stores sensitive material, controls access carefully, and presents a surface that looks more hardened than it is. No single weakness hands you the keys — but every component has something it trusts a little too much.
Web
🐀
Codebleed runs the internal DevOps portal for a team that moves fast. The current deployment looks clean — polished, even. But software has a memory, and this server has been around long enough to have accumulated a history worth reading.
Web
DevOps
🐀🐀🐀🐀
🔒 Premium Only
Capsule is a data platform that was provisioned for a project, shipped on time, and handed to ops without a security checklist. The database is reachable. The data inside it is more useful than the team intended. And somewhere on this machine, a capability was granted that nobody thought to revoke.
Web
🐀🐀🐀🐀
🔒 Premium Only
Debugtrap is a Flask application running in an environment that was never quite finished. The developer tested locally, pushed to production, and moved on to the next feature. Somewhere between development and deployment, a setting that should have changed did not.
CPTS
Web
🐀🐀
🔒 Premium Only
StackDrop was built in a sprint by a developer who no longer works there. It does one thing: accept files from the build pipeline and make them available to the team. The handoff notes say it was hardened before go-live. The new team assumed that meant it was done.
Binary Exploit
🐀🐀🐀🐀🐀
🔒 Premium Only
r4tking built his own private operations platform — implant registry, remote probe, operator management. He thought it was locked down. Find the cracks, chain them together, and own the machine from web panel to root shell. Nothing here is accidental.
🐀🐀🐀🐀🐀
🔒 Premium Only
MirrorNet Corp ran a covert data intelligence platform. After their takedown, one server was left running. The admin swore it was hardened — 'everything real is behind another layer'. Dozens of researchers have tried. They all came back with flags. Every one of them was fake.
🐀🐀
The SolarGate incident team flagged unusual activity on prod-web-01. A file-upload vulnerability gave an attacker a foothold as www-data, and the logs show things escalated from there. Your job: step into the analyst's seat, reconstruct what happened, and finish the job the attacker started.
🐀
Inkblot runs an internal CMS built by someone who trusted their logs a little too much. The file inclusion is right there. What you put in the request is what ends up in the log. What ends up in the log ends up on the page.
🐀🐀
🔒 Premium Only
Blindspot is an internal URL validation tool. It checks whether endpoints are reachable — and it makes those requests from the server. There's an internal configuration service that wasn't supposed to be externally accessible.
🐀🐀🐀
🔒 Premium Only
TokenSmith is an internal OAuth 2.0 provider. It handles authorization flows and issues tokens to clients. There's a known issue in the tracker about redirect_uri validation — issue #214, filed months ago, still open.
🐀🐀🐀🐀
🔒 Premium Only
Threadbare runs a privileged file integrity checker. It verifies that you own a file before reading it as root. The check and the read are two separate operations — and the filesystem doesn't stand still between them.
🐀🐀🐀
🔒 Premium Only
Breakout is an internal container management console that was meant to be ops-only. Someone left a debug endpoint live. The container has more access to the runtime than it should — and so do you.
🐀🐀
🔒 Premium Only
Shapeshifter is an internal developer profile service built with Node.js. It lets users update their profile data through a flexible merge endpoint — one that trusts deeply nested JSON a little too much.
🐀🐀🐀
🔒 Premium Only
Synapse is an internal ML Model Hub that lets data science teams upload and share serialized model files. The platform loads every uploaded model automatically — trusting the data because trust is faster than validation.
🐀🐀🐀
🔒 Premium Only
NullSecurityX runs an internal bug bounty triage platform. The dev team pushed source code to production with the .git directory intact. Three vulnerabilities to chain — none of them obvious until you look closely.
Web
CPTS
🐀
SolarGate Energy's solar monitoring server has a misconfigured Python binary and a web service that's a little too helpful. Foothold first, SUID second.
OSCP
Privesc
Web
Project Meridian
🐀
🔒 Premium Only
The Meridian central data hub runs a root-owned cleanup task every minute. Someone on the ops team made the script world-writable. They trusted the filesystem more than they should have.
OSCP
Privesc
Network
Project Meridian
🐀🐀
VoltCore's network diagnostics panel passes your input straight to ping. The sudo policy for the next hop is generous. Two steps to root.
OSCP
Privesc
Web
Project Meridian
🐀🐀
🔒 Premium Only
GridLock's power management node runs awk as root for log analysis. The IT team didn't read the GTFOBins entry for awk. You did.
OSCP
Privesc
Project Meridian
🐀🐀🐀
🔒 Premium Only
Apex is the hardest node in the SolarGate network. The document reader doesn't validate paths. Python has a capability it shouldn't. Chain them.
OSCP
Privesc
Web
Project Meridian
🐀🐀🐀
🔒 Premium Only
An ASP.NET Core profile-import microservice deserializes attacker-supplied JSON with Newtonsoft.Json TypeNameHandling.All — polymorphic $type metadata lets you instantiate arbitrary .NET types. One of the app's own types runs a shell command on a property set, giving unauthenticated RCE. Loot leaked SSH creds from config, then escalate via a sudo GTFObins one-liner.
🐀🐀🐀🐀
🔒 Premium Only
The ops team's internal GraphQL API was never meant to be externally accessible — but here we are. Introspection is enabled. Fields that should require authentication don't. And the JWT library has a configuration the developer clearly didn't read the RFC for.
Web
Enumeration
No challenges match the selected filters.
